VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026

CVE-2026-87779

CVE-2026-87779

Description

Insertion of sensitive information into log file vulnerability in Apache Syncope.

When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged.

This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1
  • Apache/Syncopellm-fuzzy
    Range: 3.0.15 - 3.0.16, 4.0.3 - 4.0.7, 4.1.0-M0 - 4.1.2

Patches

Vulnerability mechanics

References

2

News mentions

1